CVE-2024-49904

What it actually does

Null pointer dereference in the AMDGPU DRM driver when list_for_each_entry_safe is invoked on an empty list in corner cases without an explicit empty check.

Why it matters to the business

Kernel crashes or denial of service on Linux systems with AMD GPUs, disrupting graphics, compute, and container workloads across affected Rocky Linux environments.

How an attack unfolds

An attacker triggers specific DRM or graphics operations that reach a corner case leaving an amdgpu internal list empty; the missing empty-list guard allows list_for_each_entry_safe to dereference a null pointer and panic the kernel. Similar Linux kernel memory issues have been targeted by espionage and financially motivated actors in 2024 zero-day campaigns.

How to fix it

Apply the upstream fix (commit 5ec731ef47f1dba34daad3e51a93de793f9319ac) or upgrade to a patched kernel. For Rocky Linux 8 packages update to the listed fixed versions: containernetworking-plugins 0:0.8.3-4.module+el8.5.0+770+e2f49861, cockpit-podman 0:11-1.module+el8.5.0+770+e2f49861, python-podman-api 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861, udica 0:0.2.1-2.module+el8.5.0+770+e2f49861, container-selinux 2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f, slirp4netns 0:0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861, criu 0:3.12-9.module+el8.5.0+681+c9a1951f, toolbox 0:0.0.7-1.module+el8.5.0+770+e2f49861.

How to confirm the fix worked

Confirm the amdgpu source contains an explicit list-empty guard before list_for_each_entry_safe; verify running kernel matches or exceeds the fixed commit hash; test graphics workloads that previously exercised the corner case.

Typical attack path

1. Identify Linux host running vulnerable amdgpu driver
2. Craft or trigger graphics/DRM workload that produces an empty list condition
3. Execute operation invoking list_for_each_entry_safe without prior empty check
4. Induce null pointer dereference resulting in kernel panic or oops

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing amdgpu and list operations; correlate with process activity involving DRM or container graphics workloads.

What your security team should do

• Apply kernel and package updates immediately on AMD GPU systems
• Prioritize patching given broad downstream package impact in Rocky Linux 8
• Add kernel oops monitoring for amdgpu list-related null dereferences
• Validate updates in non-production environments before broad rollout